omp-conductor 0.20.1 → 0.20.2

package/src/daemon/views.ts

@@ -23,6 +23,7 @@ import { availabilityState, type AvailabilityState } from "../availability.ts";
 import { configPath, findProject, loadConfig, resolveCaps, resolveReleaseGrants, resolveReview, stateDir } from "../config.ts";
 import { digestScheduleState, type DigestScheduleState } from "../digest-schedule.ts";
 import { SPEND_SAMPLE_ROWS, SPEND_SAMPLE_RUNS } from "../doctor.ts";
+import { EFFECTIVE_BUDGET_SAMPLE_RUNS, observeTurnBudget, type ObservedTurnBudget } from "../failure-class.ts";
 import type { CodeGraphHealth } from "../graph-health.ts";
 import { isPaused, pauseProvenance, setPaused } from "../pause.ts";
 import { branchName, route } from "../routing.ts";
@@ -189,6 +190,11 @@ export interface StatusSnapshot {
    */
   reporting?: ReportingSummary;
   caps: Caps;
+  /** #1063: the turn count the wall-clock ceiling actually buys at this
+   *  project's observed per-turn latency, with the sample it was derived
+   *  from. Absent when no qualifying completed run exists — never derived
+   *  from the configured constants, whose ratio is a constant. */
+  workerTurnBudgetObserved?: ObservedTurnBudget;
   /**
    * The effective per-shape release grants. On the snapshot rather than re-read
    * by each renderer because #122 began with a grant nobody had looked at in
@@ -552,6 +558,17 @@ export function statusSnapshotFromStore(
       const observed = store.installSurfaces();
       return observed === undefined ? {} : { installSurfaces: observed };
     })(),
+    // #1063, the same read-not-probe discipline as the spend judgement above:
+    // derived from completed-run rows on this read, never probed at render
+    // time. The renderer decides whether the figure is materially lower.
+    ...(() => {
+      const budget = observeTurnBudget(
+        store.recentLatencySamples(p.name, EFFECTIVE_BUDGET_SAMPLE_RUNS),
+        caps,
+        p.workerModel,
+      );
+      return budget === undefined ? {} : { workerTurnBudgetObserved: budget };
+    })(),
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(planUsage === undefined ? {} : { planUsage }),
     // Written by the tracker's hooks rather than polled, so the renderer does

package/src/daemon.ts

@@ -34,7 +34,7 @@ export type {
 export { completionLastError, exhaustedSessionReason, verbDeps } from "./daemon/deps.ts";
 
 export type { CreateDrainOptions, DrainProblem, DrainRecord, DrainVerdict } from "./daemon/drain.ts";
-export { cancelDrain, consumeDrain, createDrain, drainPath, readDrain } from "./daemon/drain.ts";
+export { cancelDrain, consumeDrain, createDrain, drainPath, markDrained, readDrain } from "./daemon/drain.ts";
 
 export type { AdmissionAckRecord } from "./daemon/ack.ts";
 export { admissionAckPath, daemonGeneration, readAdmissionAck, wakeDaemon, writeAdmissionAck } from "./daemon/ack.ts";
@@ -52,6 +52,7 @@ export {
   wakeOrchestratorForBlockedRun,
   wakeOrchestratorForMetConditions,
   watchOrchestrator,
+  watchWorkerProgress,
 } from "./daemon/supervision.ts";
 
 export { reconcilePanes } from "./daemon/panes.ts";

package/src/decisions.ts

@@ -45,26 +45,35 @@ const NPM_SPEC = /^(@[^/@\s]+\/)?[^@\s]+@[^\s]+$/;
 const GREEN_CHECK_STATES: Record<string, true> = { success: true, neutral: true };
 
 /**
- * The run states a review revision may start from (#795) — the single
+ * The run states a review revision may start from (#795, #1101) — the single
  * definition shared by `conductor_pr_review` and the `pr-review-ready` watch,
  * so the verb's gate and the condition can never name different sets.
  *
  * A revision round resumes the exact run whose row owns the PR, so the
- * revisable states are exactly the terminal runs that pushed one: a settled
- * `pushed-green` row, or a `failed` / `killed` row — a run that capped or
- * failed *after* pushing a green PR. The PR is the durable artefact, the
- * exact-head green verification is the gate on "green at the reviewed SHA",
- * and a terminal row proves no worker is in flight, so findings are returned
+ * revisable states are exactly the terminal runs that own the named PR: a
+ * settled `pushed-green` row, a `failed` / `killed` row — a run that capped or
+ * failed *after* pushing a green PR — and, since #1101, a `stopped` row that
+ * pushed one. Ownership is not carried by the state alone: selection runs
+ * through `runsForProjectPr`, so only a row that itself recorded the reviewed
+ * PR can ever reach this gate. The PR is the durable artefact, the exact-head
+ * green verification is the gate on "green at the reviewed SHA", and a
+ * terminal row proves no worker is in flight, so findings are returned
  * without the close-PR → unblock → continuation dance.
  *
+ * A `stopped` row has no settle sweep keeping it honest (nothing transitions a
+ * stopped row when its PR merges or closes), so like `failed` / `killed` its
+ * rounds re-read PR-open and green-at-head decisively before the claim — the
+ * dispatch pass refuses to wake a worker against a dead or moved PR.
+ *
  * Closed on purpose: a live row (`running` / `claimed`) is already doing its
  * own work, a `pushed-pending` PR is not green yet, and a `blocked` /
- * `orphaned` / `stopped` / `merged` row is not work returned for revision.
+ * `orphaned` / `merged` row is not work returned for revision.
  */
 export const REVISABLE_RUN_STATES: Record<string, true> = {
   "pushed-green": true,
   failed: true,
   killed: true,
+  stopped: true,
 };
 
 /**
@@ -92,8 +101,10 @@ export const PR_LOOKUP_WINDOW_MS = 30 * 24 * 60 * 60_000;
  * `running`, and a watch keyed only to checks woke the orchestrator before
  * `conductor_pr_review` was actionable), `pushed-pending` checks are still
  * settling, `blocked` may resume, `orphaned` is reconciled back to live at
- * startup, and `merged` means the PR lifecycle is over. When every row is
- * `stopped`, the newest one answers and the predicate fails closed.
+ * startup, and `merged` means the PR lifecycle is over. When every row of the
+ * history is `stopped`, the newest one answers — and since #1101 it answers
+ * `ready` when it owns the named PR: stopping a worker that had already pushed
+ * must leave the PR reviewable rather than stranded.
  *
  * `no-owner` and `not-revisable` both fail closed: a review can never act, so
  * a watch must not wake, even when the checks are green.

package/src/diff-flags.ts

@@ -37,7 +37,7 @@
  * repository.
  */
 
-import type { FileLane, PrDiff, PrDiffFile, SettlementFlag } from "./types.ts";
+import type { FileLane, PrDiff, PrDiffFile, SettlementFlag, SettlementFlagKind } from "./types.ts";
 
 // ------------------------------------------------------------------ diff parse
 
@@ -657,21 +657,24 @@ export const UNREADABLE_TREE_FLAG: SettlementFlag = {
 
 /**
  * Whether a diff path counts as inside the declared lane: an explicitly
- * declared path, or the co-located test of one — `foo.ts` vouches for
- * `foo.test.ts`, which is the "obviously intended" case. Other test shapes
- * (`.spec.ts`, pytest's `test_` prefix) are not vouched for: the rule is the
- * shape the fleet actually uses, and a lane that wants a differently-shaped
- * sibling declares it. Deliberately one-directional: a lane that declares a
- * *test* file does not vouch for its source, because declaring the test alone
- * is a narrower promise and widening it silently is exactly what this flag
- * exists to name. A containing directory never vouches for its contents
- * either — the lane grammar names files, and a lane that means "everything
- * under `src/`" fails open exactly as an undeclared one would if it cannot
- * name them.
+ * declared path, the co-located test of one, or a descendant of a declared
+ * directory (#1091) — admission's grammar accepts a trailing-`/` entry
+ * ("everything under `src/`"), so settlement honours the same contract rather
+ * than narrowing it back to exact files. The co-located allowance is the
+ * "obviously intended" case: `foo.ts` vouches for `foo.test.ts`. Other test
+ * shapes (`.spec.ts`, pytest's `test_` prefix) are not vouched for: the rule
+ * is the shape the fleet actually uses, and a lane that wants a
+ * differently-shaped sibling declares it. Deliberately one-directional: a lane
+ * that declares a *test* file does not vouch for its source, because declaring
+ * the test alone is a narrower promise and widening it silently is exactly
+ * what this flag exists to name. The directory rule keeps its trailing-slash
+ * boundary explicit: the entry already carries the separator, so `foo/`
+ * covers `foo/bar.ts` at any depth and can never vouch for `foobar/x.ts`.
  */
 function withinLane(path: string, declared: readonly string[]): boolean {
   if (declared.includes(path)) return true;
   for (const d of declared) {
+    if (d.endsWith("/") && path.startsWith(d)) return true;
     if (coLocatedTest(d) === path) return true;
   }
   return false;
@@ -693,11 +696,22 @@ function coLocatedTest(declared: string): string | undefined {
  * The lane is the effective declaration admission resolved at dispatch —
  * `effectiveLane(body, comments)`, so a pre-dispatch comment beats an older
  * body declaration — and the flag uses that resolved snapshot, never a re-parse
- * of the body. The finding names every delivered file outside it, which is the
+ * of the body. Each finding names the delivered files outside it, which is the
  * part a reviewer is worst placed to notice: the diff's own file list is the
  * only surface that shows the escape, and reading PR file lists by hand is
  * exactly what nothing else in the loop does.
  *
+ * An escape splits into up to two findings because it is up to two different
+ * events (#1096): an undeclared production module is scope escaping into code,
+ * while an undeclared test file is usually coverage arriving beside the
+ * behaviour it pins — the #1064/#1080 shape, required work the declaration
+ * could not have named. Naming the class on each finding keeps the second
+ * readable as what it usually is without letting it disguise the first. The
+ * declared source's own `.test` twin is admitted by {@link withinLane}, so
+ * the obvious case raises nothing — and the rule stays one-directional, so a
+ * lane declaring only the test still names its source when the worker edits
+ * it.
+ *
  * Fail-open, like admission: an issue with no lane declaration has nothing to
  * escape, so no flag — a flag on every undeclared run would be noise within a
  * day, worse than no flag. Advisory like every other flag here: a widened lane
@@ -710,11 +724,23 @@ function detectLaneEscape(audit: SettlementAudit, flags: SettlementFlag[]): void
     .map((f) => f.path)
     .filter((path) => !withinLane(path, lane.files));
   if (outside.length === 0) return;
-  flags.push({
-    kind: "lane-escape",
-    file: "(lane)",
-    detail: `PR diff touches files outside the declared file lane: ${outside.join(", ")}`,
-  });
+  // Production first: the rarer, heavier event leads the report block.
+  const production = outside.filter((path) => !isTestPath(path));
+  const otherTests = outside.filter((path) => isTestPath(path));
+  if (production.length > 0) {
+    flags.push({
+      kind: "lane-escape",
+      file: "(lane)",
+      detail: `PR diff touches production files outside the declared file lane: ${production.join(", ")}`,
+    });
+  }
+  if (otherTests.length > 0) {
+    flags.push({
+      kind: "lane-escape",
+      file: "(lane)",
+      detail: `PR diff touches unrelated test files outside the declared file lane: ${otherTests.join(", ")}`,
+    });
+  }
 }
 
 function detectWeakening(audit: SettlementAudit, flags: SettlementFlag[]): void {
@@ -1229,6 +1255,21 @@ const RENDERED_FLAGS = 20;
 
 const HEADING = "settlement audit";
 
+/**
+ * The kinds that mean coverage got weaker — the quiet signals the audit
+ * exists to deliver, and the family mining.ts mines. Presentation keeps them
+ * ahead of everything else and lane escapes last (#1096): a check that fires
+ * on half of all merges gets skimmed, and a skimmed finding must not sit
+ * between the reviewer and these. Kept in step with `WEAKENING_KINDS` in
+ * mining.ts, which is the same four kinds spelled for mining.
+ */
+const TEST_INTEGRITY_KINDS: Partial<Record<SettlementFlagKind, true>> = {
+  "test-file-deleted": true,
+  "test-disabled": true,
+  "assertions-removed": true,
+  "test-timeout-raised": true,
+};
+
 /**
  * The flag block appended to a settlement report, or no lines at all.
  *
@@ -1253,7 +1294,17 @@ export function formatSettlementFlags(
     `${HEADING}: ${flags.length} advisory flag(s) — the run's state is unchanged by them` +
       (diff.truncated ? ", and the PR diff was too large to read in full" : ""),
   ];
-  for (const flag of flags.slice(0, RENDERED_FLAGS)) {
+  // Presentation order is structural, not incidental: test-integrity flags
+  // first, then everything else, lane escapes last (#1096). The analyser
+  // emits them in roughly this order already, but this surface also renders
+  // stored rows and post-settlement appends, whose order nobody chose.
+  const rank = (flag: SettlementFlag): number =>
+    TEST_INTEGRITY_KINDS[flag.kind] === true ? 0 : flag.kind === "lane-escape" ? 2 : 1;
+  const ordered = flags
+    .map((flag, index) => ({ flag, index }))
+    .sort((a, b) => rank(a.flag) - rank(b.flag) || a.index - b.index)
+    .map((entry) => entry.flag);
+  for (const flag of ordered.slice(0, RENDERED_FLAGS)) {
     if (flag.kind === "pr-adopted") {
       lines.push(`  ${flag.kind} — ${flag.detail}`);
       continue;
@@ -1270,10 +1321,30 @@ export function formatSettlementFlags(
 }
 
 /** The one-line form for `omp-conductor status`, where a flagged run has to be
- *  visible long after its escalation was delivered and deduplicated. */
+ *  visible long after its escalation was delivered and deduplicated. Lane
+ *  escapes are presented apart from the test-integrity family (#1096), so the
+ *  noisy check cannot bury the quiet one in one comma join. */
 export function settlementFlagSummary(flags: readonly SettlementFlag[] | undefined): string | undefined {
   if (flags === undefined || flags.length === 0) return undefined;
-  const kinds = [...new Set(flags.map((f) => f.kind))].join(", ");
+  const integrity = new Set<SettlementFlagKind>();
+  const lane = new Set<SettlementFlagKind>();
+  const rest = new Set<SettlementFlagKind>();
+  for (const { kind } of flags) {
+    if (TEST_INTEGRITY_KINDS[kind] === true) integrity.add(kind);
+    else if (kind === "lane-escape") lane.add(kind);
+    else rest.add(kind);
+  }
+  const segments: { label?: string; kinds: SettlementFlagKind[] }[] = [];
+  if (integrity.size > 0) segments.push({ label: "test-integrity", kinds: [...integrity] });
+  if (rest.size > 0) segments.push({ kinds: [...rest] });
+  if (lane.size > 0) segments.push({ label: "lane", kinds: [...lane] });
+  // One family alone reads exactly as before — a label with nothing to
+  // separate is furniture.
+  const parts = segments.map((segment) =>
+    segments.length > 1 && segment.label !== undefined
+      ? `${segment.label}: ${segment.kinds.join(", ")}`
+      : segment.kinds.join(", "),
+  );
   const loud = flags.some((f) => f.unattributed === true) ? ", some unattributed" : "";
-  return `${HEADING}: ${flags.length} flag(s) — ${kinds}${loud}`;
+  return `${HEADING}: ${flags.length} flag(s) — ${parts.join("; ")}${loud}`;
 }

package/src/doctor.ts

@@ -71,6 +71,7 @@ import {
   killOf,
   readTelegramChannel,
   readTelegramDmOwner,
+  readTelegramMisroutes,
   readTelegramPollState,
   resolveClaimedSessionFile,
   resolveProjectClaim,
@@ -82,6 +83,7 @@ import {
   type TelegramChannelState,
   type TelegramDmOwnerState,
   type TelegramPollState,
+  type TelegramMisroute,
 } from "./escalate.ts";
 import {
   herdrConductorPluginConfigDir,
@@ -286,6 +288,11 @@ export interface DoctorDeps {
    *  `unavailable` when the registry cannot be read or does not parse — the
    *  caller must not read that as "no claims" (#626). */
   claimedTopics?: () => ClaimedTopicsResult;
+  /** Recorded flat-chat deliveries this project's stale pin already caused
+   *  (#1094), read from conductor state. The topic-pin row renders them as
+   *  observed evidence until the pin is repaired — rows match the *current*
+   *  pin id, so re-pinning is what retires them. */
+  topicMisroutes?: () => readonly TelegramMisroute[];
   /** Whether the bridge's access.json runs per-session topic tidy on. */
   topicsTidy?: () => boolean;
   /** The typed bot.lock poll-ownership read, told apart so absent/malformed
@@ -1390,14 +1397,24 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
       `[${p.name}] no pinned topic id — sends go to the flat chat (live-claim substitution only follows a stale pin)`,
     );
   }
+  // #1094: sends that already rode the flat chat because of THIS pin turn the
+  // warnings below from hypothetical into observed. Rows are keyed to the pin
+  // id, so re-pinning retires them — nothing deletes them.
+  const misroutes = probes.topicMisroutes().filter(
+    (row) => row.project === p.name && row.staleTopicId === pinned,
+  );
+  const misrouteNote =
+    misroutes.length === 0
+      ? ""
+      : ` It has happened: ${misroutes.length} send(s) were delivered to the flat chat because of this pin, last at ${new Date(misroutes[misroutes.length - 1]!.at).toISOString()}`;
   const result = probes.claimedTopics();
   if (result.kind !== "ok") {
     return warnFinding(
       "topic-pin",
       `[${p.name}] pinned topic ${pinned} — ` +
         (result.kind === "missing"
-          ? `omp-telegram has no claim registry (threads.json in its state dir), so doctor cannot tell whether the pin is live or a claim answers to this project`
-          : `omp-telegram's claim registry is unreadable (${result.problem}), so doctor cannot tell whether the pin is live or a claim answers to this project`),
+          ? `omp-telegram has no claim registry (threads.json in its state dir), so doctor cannot tell whether the pin is live or a claim answers to this project${misrouteNote}`
+          : `omp-telegram's claim registry is unreadable (${result.problem}), so doctor cannot tell whether the pin is live or a claim answers to this project${misrouteNote}`),
       `check omp-telegram's claim registry (threads.json in its state dir) is readable and the bridge is running, then re-run doctor — until then sends keep the pinned topic and degrade to the flat chat on a missing thread (#318)`,
     );
   }
@@ -1423,7 +1440,7 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
     if (dead.length > 0) {
       return warnFinding(
         "topic-pin",
-        `[${p.name}] pinned topic ${pinned} — every claim in omp-telegram's registry is dead${deadNote}`,
+        `[${p.name}] pinned topic ${pinned} — every claim in omp-telegram's registry is dead${deadNote}${misrouteNote}`,
         `run /cleanup in Telegram so the bridge closes those topics and drops their rows itself, then re-run setup to re-pin escalation.telegramTopicId to a live claim — never delete rows from threads.json by hand, because the row is the only index to the remote topic (#987)`,
       );
     }
@@ -1437,7 +1454,7 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
   if (claims.some((claim) => claim.threadId === pinned)) {
     return passFinding("topic-pin", `[${p.name}] pinned topic ${pinned} is a live claim${deadNote}`);
   }
-  const match = resolveProjectClaim(claims, p.name, probes.pidAlive);
+  const match = resolveProjectClaim(claims, p.name, probes.pidAlive, p.workspaceRoot);
   if (match.kind === "match") {
     return passFinding(
       "topic-pin",
@@ -1454,7 +1471,7 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
     return warnFinding(
       "topic-pin",
       `[${p.name}] pinned topic ${pinned} is not among omp-telegram's live claims, and several live claims answer to this project ` +
-        `(topics ${match.claimants.map((c) => c.threadId).join(", ")}) — substitution would be a coin toss, so sends keep the stale pin`,
+        `(topics ${match.claimants.map((c) => c.threadId).join(", ")}) — substitution would be a coin toss, so sends keep the stale pin${misrouteNote}`,
       `make exactly one live claim answer to this project: rename the other panes' herdr spaces or re-claim them one at a time, then re-run doctor — live-claim substitution follows the unique claim from there`,
     );
   }
@@ -1463,14 +1480,14 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
       "topic-pin",
       `[${p.name}] pinned topic ${pinned} is not among omp-telegram's live claims, no live claim answers ` +
         `to this project, and this host runs topicsTidy — the pin is vestigial and can never be live again ` +
-        `(every pane exit closes its topic); sends keep the stale pin`,
+        `(every pane exit closes its topic); sends keep the stale pin${misrouteNote}`,
       `turn topicsTidy off, then re-run setup to re-pin escalation.telegramTopicId to a currently claimed topic`,
     );
   }
   return warnFinding(
     "topic-pin",
     `[${p.name}] pinned topic ${pinned} is not among omp-telegram's live claims (${claims.map((c) => c.threadId).join(", ")}), ` +
-      `and no live claim answers to this project — sends keep the stale pin and degrade to the flat chat`,
+      `and no live claim answers to this project — sends keep the stale pin and degrade to the flat chat${misrouteNote}`,
     `update escalation.telegramTopicId to a currently claimed topic, or re-run setup to re-pin`,
   );
 }
@@ -2163,6 +2180,7 @@ export function defaultProbes(): Probes {
     herdrConfig: defaultHerdrConfig,
     herdrEnv: defaultHerdrEnv,
     claimedTopics: () => claimedTelegramTopics(),
+    topicMisroutes: () => readTelegramMisroutes(),
     topicsTidy: () => telegramTopicsTidy(),
     pollState: () => readTelegramPollState(),
     dmOwner: () => readTelegramDmOwner(),